clodds 1.1.0

package/dist/security/index.js

@@ -0,0 +1,498 @@
+"use strict";
+/**
+ * Security Module - Clawdbot-style security and access control
+ *
+ * Features:
+ * - DM pairing for authentication
+ * - User allowlists and blocklists
+ * - Sandbox mode for untrusted input
+ * - Rate limiting
+ * - Input sanitization
+ * - Token/secret management
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.access = exports.pairing = exports.SecretStore = exports.RateLimiter = exports.AccessControl = exports.PairingManager = void 0;
+exports.sanitize = sanitize;
+exports.detectInjection = detectInjection;
+exports.createSandbox = createSandbox;
+exports.hash = hash;
+exports.hashPassword = hashPassword;
+exports.verifyPassword = verifyPassword;
+exports.generateToken = generateToken;
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
+const util_1 = require("util");
+const logger_1 = require("../utils/logger");
+const scryptAsync = (0, util_1.promisify)(crypto_1.scrypt);
+// =============================================================================
+// CONSTANTS
+// =============================================================================
+const PAIRING_CODE_LENGTH = 6;
+const PAIRING_CODE_EXPIRY = 5 * 60 * 1000; // 5 minutes
+const ENCRYPTION_ALGORITHM = 'aes-256-gcm';
+// =============================================================================
+// PAIRING SYSTEM
+// =============================================================================
+class PairingManager {
+    codes = new Map();
+    pairedUsers = new Set();
+    storePath;
+    constructor(storePath) {
+        this.storePath = storePath || (0, path_1.join)((0, os_1.homedir)(), '.clodds', 'paired-users.json');
+        this.loadPairedUsers();
+    }
+    loadPairedUsers() {
+        try {
+            if ((0, fs_1.existsSync)(this.storePath)) {
+                const data = JSON.parse((0, fs_1.readFileSync)(this.storePath, 'utf-8'));
+                this.pairedUsers = new Set(data.users || []);
+            }
+        }
+        catch (error) {
+            logger_1.logger.error({ error }, 'Failed to load paired users');
+        }
+    }
+    savePairedUsers() {
+        try {
+            const dir = (0, path_1.join)(this.storePath, '..');
+            if (!(0, fs_1.existsSync)(dir)) {
+                (0, fs_1.mkdirSync)(dir, { recursive: true });
+            }
+            (0, fs_1.writeFileSync)(this.storePath, JSON.stringify({
+                users: Array.from(this.pairedUsers),
+                updated: new Date().toISOString(),
+            }, null, 2));
+        }
+        catch (error) {
+            logger_1.logger.error({ error }, 'Failed to save paired users');
+        }
+    }
+    /** Generate a pairing code for a user */
+    generateCode(userId) {
+        // Clean up expired codes
+        this.cleanupExpired();
+        // Generate random code
+        const code = (0, crypto_1.randomBytes)(3).toString('hex').toUpperCase().slice(0, PAIRING_CODE_LENGTH);
+        this.codes.set(code, {
+            code,
+            userId,
+            expiresAt: new Date(Date.now() + PAIRING_CODE_EXPIRY),
+            used: false,
+        });
+        logger_1.logger.info({ userId, code }, 'Pairing code generated');
+        return code;
+    }
+    /** Verify a pairing code */
+    verifyCode(code, userId) {
+        const pairing = this.codes.get(code.toUpperCase());
+        if (!pairing) {
+            return { valid: false, reason: 'Invalid code' };
+        }
+        if (pairing.used) {
+            return { valid: false, reason: 'Code already used' };
+        }
+        if (pairing.expiresAt < new Date()) {
+            this.codes.delete(code);
+            return { valid: false, reason: 'Code expired' };
+        }
+        if (pairing.userId !== userId) {
+            return { valid: false, reason: 'Code does not match user' };
+        }
+        // Mark as used and pair user
+        pairing.used = true;
+        this.pairedUsers.add(userId);
+        this.savePairedUsers();
+        logger_1.logger.info({ userId }, 'User paired successfully');
+        return { valid: true };
+    }
+    /** Check if a user is paired */
+    isPaired(userId) {
+        return this.pairedUsers.has(userId);
+    }
+    /** Unpair a user */
+    unpair(userId) {
+        this.pairedUsers.delete(userId);
+        this.savePairedUsers();
+        logger_1.logger.info({ userId }, 'User unpaired');
+    }
+    /** Get all paired users */
+    getPairedUsers() {
+        return Array.from(this.pairedUsers);
+    }
+    cleanupExpired() {
+        const now = new Date();
+        for (const [code, pairing] of this.codes) {
+            if (pairing.expiresAt < now || pairing.used) {
+                this.codes.delete(code);
+            }
+        }
+    }
+}
+exports.PairingManager = PairingManager;
+// =============================================================================
+// ACCESS CONTROL
+// =============================================================================
+class AccessControl {
+    allowlist;
+    blocklist;
+    pairingManager;
+    requirePairing;
+    constructor(config = {}) {
+        this.allowlist = new Set(config.allowlist || []);
+        this.blocklist = new Set(config.blocklist || []);
+        this.requirePairing = config.requireDmPairing ?? false;
+        this.pairingManager = new PairingManager();
+    }
+    /** Check if a user is allowed */
+    checkAccess(userId) {
+        // Check blocklist first
+        if (this.blocklist.has(userId)) {
+            return { allowed: false, reason: 'User is blocked', userId };
+        }
+        // Check allowlist (if non-empty, only allowlisted users allowed)
+        if (this.allowlist.size > 0 && !this.allowlist.has(userId)) {
+            return { allowed: false, reason: 'User not in allowlist', userId };
+        }
+        // Check pairing requirement
+        if (this.requirePairing && !this.pairingManager.isPaired(userId)) {
+            return { allowed: false, reason: 'User not paired', userId };
+        }
+        return { allowed: true, userId };
+    }
+    /** Add user to allowlist */
+    allow(userId) {
+        this.allowlist.add(userId);
+        this.blocklist.delete(userId);
+        logger_1.logger.info({ userId }, 'User added to allowlist');
+    }
+    /** Add user to blocklist */
+    block(userId) {
+        this.blocklist.add(userId);
+        this.allowlist.delete(userId);
+        logger_1.logger.info({ userId }, 'User added to blocklist');
+    }
+    /** Remove user from all lists */
+    reset(userId) {
+        this.allowlist.delete(userId);
+        this.blocklist.delete(userId);
+    }
+    /** Get pairing manager */
+    getPairingManager() {
+        return this.pairingManager;
+    }
+}
+exports.AccessControl = AccessControl;
+class RateLimiter {
+    limits = new Map();
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    /** Check if request is allowed */
+    check(key) {
+        const now = Date.now();
+        let entry = this.limits.get(key);
+        // Clean up or create new entry
+        if (!entry || entry.resetAt <= now) {
+            entry = { count: 0, resetAt: now + this.config.windowMs };
+            this.limits.set(key, entry);
+        }
+        const remaining = Math.max(0, this.config.maxRequests - entry.count);
+        const resetIn = Math.max(0, entry.resetAt - now);
+        if (entry.count >= this.config.maxRequests) {
+            return { allowed: false, remaining: 0, resetIn };
+        }
+        entry.count++;
+        return { allowed: true, remaining: remaining - 1, resetIn };
+    }
+    /** Reset rate limit for a key */
+    reset(key) {
+        this.limits.delete(key);
+    }
+    /** Cleanup expired entries */
+    cleanup() {
+        const now = Date.now();
+        for (const [key, entry] of this.limits) {
+            if (entry.resetAt <= now) {
+                this.limits.delete(key);
+            }
+        }
+    }
+}
+exports.RateLimiter = RateLimiter;
+// =============================================================================
+// INPUT SANITIZATION
+// =============================================================================
+/** Sanitize user input */
+function sanitize(input, options = {}) {
+    let result = input;
+    // Truncate if needed
+    if (options.maxLength && result.length > options.maxLength) {
+        result = result.slice(0, options.maxLength);
+    }
+    // Strip HTML unless allowed
+    if (!options.allowHtml) {
+        result = result.replace(/<[^>]*>/g, '');
+    }
+    // Strip URLs unless allowed
+    if (!options.allowUrls) {
+        result = result.replace(/https?:\/\/[^\s]+/gi, '[URL]');
+    }
+    // Strip code blocks unless allowed
+    if (!options.allowCode) {
+        result = result.replace(/```[\s\S]*?```/g, '[CODE]');
+        result = result.replace(/`[^`]+`/g, '[CODE]');
+    }
+    // Remove null bytes and other dangerous chars
+    result = result.replace(/\0/g, '');
+    // Normalize whitespace
+    result = result.replace(/\r\n/g, '\n').replace(/\r/g, '\n');
+    return result.trim();
+}
+/** Check for potential injection attacks */
+function detectInjection(input) {
+    const threats = [];
+    // SQL injection patterns
+    const sqlPatterns = [
+        /'\s*(?:OR|AND)\s*'?\d*'?\s*=\s*'?\d*'?/i,
+        /;\s*(?:DROP|DELETE|UPDATE|INSERT)\s/i,
+        /UNION\s+(?:ALL\s+)?SELECT/i,
+    ];
+    for (const pattern of sqlPatterns) {
+        if (pattern.test(input)) {
+            threats.push('SQL injection');
+            break;
+        }
+    }
+    // Command injection patterns
+    const cmdPatterns = [
+        /[;&|`$]|\$\(/,
+        /\|\s*(?:cat|ls|rm|wget|curl)\s/i,
+    ];
+    for (const pattern of cmdPatterns) {
+        if (pattern.test(input)) {
+            threats.push('Command injection');
+            break;
+        }
+    }
+    // XSS patterns
+    const xssPatterns = [
+        /<script[\s>]/i,
+        /javascript:/i,
+        /on\w+\s*=/i,
+    ];
+    for (const pattern of xssPatterns) {
+        if (pattern.test(input)) {
+            threats.push('XSS');
+            break;
+        }
+    }
+    // Path traversal
+    if (/\.\.\/|\.\.\\/.test(input)) {
+        threats.push('Path traversal');
+    }
+    return { safe: threats.length === 0, threats };
+}
+// =============================================================================
+// SECRET MANAGEMENT
+// =============================================================================
+class SecretStore {
+    secrets = new Map();
+    encryptionKey = null;
+    storePath;
+    constructor(encryptionKey, storePath) {
+        this.storePath = storePath || (0, path_1.join)((0, os_1.homedir)(), '.clodds', 'secrets.enc');
+        if (encryptionKey) {
+            this.initEncryption(encryptionKey);
+        }
+        this.load();
+    }
+    async initEncryption(password) {
+        // Derive key from password
+        const salt = 'clodds-secrets-v1';
+        this.encryptionKey = (await scryptAsync(password, salt, 32));
+    }
+    encrypt(text) {
+        if (!this.encryptionKey)
+            return text;
+        const iv = (0, crypto_1.randomBytes)(16);
+        const cipher = (0, crypto_1.createCipheriv)(ENCRYPTION_ALGORITHM, this.encryptionKey, iv);
+        let encrypted = cipher.update(text, 'utf8', 'hex');
+        encrypted += cipher.final('hex');
+        const authTag = cipher.getAuthTag();
+        return `${iv.toString('hex')}:${authTag.toString('hex')}:${encrypted}`;
+    }
+    decrypt(encrypted) {
+        if (!this.encryptionKey)
+            return encrypted;
+        const [ivHex, authTagHex, content] = encrypted.split(':');
+        const iv = Buffer.from(ivHex, 'hex');
+        const authTag = Buffer.from(authTagHex, 'hex');
+        const decipher = (0, crypto_1.createDecipheriv)(ENCRYPTION_ALGORITHM, this.encryptionKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(content, 'hex', 'utf8');
+        decrypted += decipher.final('utf8');
+        return decrypted;
+    }
+    load() {
+        try {
+            if ((0, fs_1.existsSync)(this.storePath)) {
+                const data = (0, fs_1.readFileSync)(this.storePath, 'utf-8');
+                const parsed = JSON.parse(data);
+                for (const [key, value] of Object.entries(parsed.secrets || {})) {
+                    try {
+                        this.secrets.set(key, this.decrypt(value));
+                    }
+                    catch {
+                        // Skip secrets we can't decrypt
+                    }
+                }
+            }
+        }
+        catch (error) {
+            logger_1.logger.error({ error }, 'Failed to load secrets');
+        }
+    }
+    save() {
+        try {
+            const dir = (0, path_1.join)(this.storePath, '..');
+            if (!(0, fs_1.existsSync)(dir)) {
+                (0, fs_1.mkdirSync)(dir, { recursive: true });
+            }
+            const encrypted = {};
+            for (const [key, value] of this.secrets) {
+                encrypted[key] = this.encrypt(value);
+            }
+            (0, fs_1.writeFileSync)(this.storePath, JSON.stringify({
+                secrets: encrypted,
+                updated: new Date().toISOString(),
+            }, null, 2), { mode: 0o600 });
+        }
+        catch (error) {
+            logger_1.logger.error({ error }, 'Failed to save secrets');
+        }
+    }
+    /** Store a secret */
+    set(key, value) {
+        this.secrets.set(key, value);
+        this.save();
+    }
+    /** Get a secret */
+    get(key) {
+        return this.secrets.get(key);
+    }
+    /** Delete a secret */
+    delete(key) {
+        this.secrets.delete(key);
+        this.save();
+    }
+    /** List all secret keys */
+    keys() {
+        return Array.from(this.secrets.keys());
+    }
+}
+exports.SecretStore = SecretStore;
+/**
+ * Create a sandboxed execution context (LIMITED IMPLEMENTATION)
+ *
+ * ⚠️  SECURITY WARNING: This sandbox is NOT secure against malicious code!
+ * It only provides basic isolation and can be escaped.
+ *
+ * For production use with untrusted code, use:
+ * - `isolated-vm` package (V8 isolates)
+ * - `vm2` package (more secure VM)
+ * - Docker containers
+ *
+ * This implementation is suitable for:
+ * - Running trusted code with limited scope
+ * - Development/testing environments
+ * - Code that has already been validated
+ */
+/**
+ * SECURITY: Sandbox is DISABLED by default
+ *
+ * The previous implementation using new Function() was NOT secure and could be
+ * trivially escaped. Dynamic code execution is inherently dangerous.
+ *
+ * To enable (NOT RECOMMENDED), set ALLOW_UNSAFE_SANDBOX=true
+ * Only enable for trusted code in development/testing environments.
+ */
+function createSandbox(options = {}) {
+    const allowedModules = new Set(options.allowedModules || []);
+    const allowUnsafe = process.env.ALLOW_UNSAFE_SANDBOX === 'true';
+    if (!allowUnsafe) {
+        logger_1.logger.warn('createSandbox: Sandbox is disabled for security. Set ALLOW_UNSAFE_SANDBOX=true to enable (NOT RECOMMENDED)');
+        return {
+            eval(_code) {
+                throw new Error('Sandbox eval is disabled for security. Dynamic code execution is not allowed.');
+            },
+            require(module) {
+                if (!allowedModules.has(module)) {
+                    throw new Error(`Module '${module}' not allowed in sandbox`);
+                }
+                return require(module);
+            },
+        };
+    }
+    // Log strong warning if enabled
+    logger_1.logger.warn('createSandbox: UNSAFE SANDBOX ENABLED - This is NOT secure against malicious code!');
+    return {
+        eval(code) {
+            // ⚠️ SECURITY WARNING: This is NOT a secure sandbox - new Function can be escaped
+            // Only use with fully trusted code
+            const sandbox = {
+                console: {
+                    log: (...args) => logger_1.logger.info({ sandbox: true }, String(args)),
+                    error: (...args) => logger_1.logger.error({ sandbox: true }, String(args)),
+                },
+                setTimeout: undefined,
+                setInterval: undefined,
+                fetch: options.allowNetwork ? fetch : undefined,
+                require: undefined,
+                process: undefined,
+                __dirname: undefined,
+                __filename: undefined,
+            };
+            // Create function with restricted scope
+            const fn = new Function(...Object.keys(sandbox), `"use strict"; return (${code})`);
+            return fn(...Object.values(sandbox));
+        },
+        require(module) {
+            if (!allowedModules.has(module)) {
+                throw new Error(`Module '${module}' not allowed in sandbox`);
+            }
+            return require(module);
+        },
+    };
+}
+// =============================================================================
+// HASHING UTILITIES
+// =============================================================================
+/** Hash a string with SHA-256 */
+function hash(input) {
+    return (0, crypto_1.createHash)('sha256').update(input).digest('hex');
+}
+/** Hash a password with salt */
+async function hashPassword(password) {
+    const salt = (0, crypto_1.randomBytes)(16).toString('hex');
+    const key = (await scryptAsync(password, salt, 64));
+    return `${salt}:${key.toString('hex')}`;
+}
+/** Verify a password hash */
+async function verifyPassword(password, stored) {
+    const [salt, hash] = stored.split(':');
+    const key = (await scryptAsync(password, salt, 64));
+    return key.toString('hex') === hash;
+}
+/** Generate a secure random token */
+function generateToken(length = 32) {
+    return (0, crypto_1.randomBytes)(length).toString('hex');
+}
+// =============================================================================
+// EXPORTS
+// =============================================================================
+exports.pairing = new PairingManager();
+exports.access = new AccessControl();
+//# sourceMappingURL=index.js.map

package/dist/security/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/security/index.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;GAUG;;;AAkTH,4BA+BC;AAGD,0CAkDC;AA6JD,sCAuDC;AAOD,oBAEC;AAGD,oCAIC;AAGD,wCAIC;AAGD,sCAEC;AApnBD,mCAA2F;AAC3F,2BAAwE;AACxE,+BAA4B;AAC5B,2BAA6B;AAC7B,+BAAiC;AACjC,4CAAyC;AAEzC,MAAM,WAAW,GAAG,IAAA,gBAAS,EAAC,eAAM,CAAC,CAAC;AAkDtC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAC9B,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AACvD,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAE3C,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAa,cAAc;IACjB,KAAK,GAA6B,IAAI,GAAG,EAAE,CAAC;IAC5C,WAAW,GAAgB,IAAI,GAAG,EAAE,CAAC;IACrC,SAAS,CAAS;IAE1B,YAAY,SAAkB;QAC5B,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC;QAC9E,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC;YACH,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC;gBAC/D,IAAI,CAAC,WAAW,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,IAAA,eAAU,EAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,IAAA,cAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;YACD,IAAA,kBAAa,EAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC3C,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC;gBACnC,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACf,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,yCAAyC;IACzC,YAAY,CAAC,MAAc;QACzB,yBAAyB;QACzB,IAAI,CAAC,cAAc,EAAE,CAAC;QAEtB,uBAAuB;QACvB,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAExF,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;YACnB,IAAI;YACJ,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,CAAC;YACrD,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QAEH,eAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4BAA4B;IAC5B,UAAU,CAAC,IAAY,EAAE,MAAc;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAEnD,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACjB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,CAAC;QACvD,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACxB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;QAClD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;QAC9D,CAAC;QAED,6BAA6B;QAC7B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,eAAe,EAAE,CAAC;QAEvB,eAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACpD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACzB,CAAC;IAED,gCAAgC;IAChC,QAAQ,CAAC,MAAc;QACrB,OAAO,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IAED,oBAAoB;IACpB,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,eAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;IAC3C,CAAC;IAED,2BAA2B;IAC3B,cAAc;QACZ,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACtC,CAAC;IAEO,cAAc;QACpB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACzC,IAAI,OAAO,CAAC,SAAS,GAAG,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;gBAC5C,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA9GD,wCA8GC;AAED,gFAAgF;AAChF,iBAAiB;AACjB,gFAAgF;AAEhF,MAAa,aAAa;IAChB,SAAS,CAAc;IACvB,SAAS,CAAc;IACvB,cAAc,CAAiB;IAC/B,cAAc,CAAU;IAEhC,YAAY,SAAyB,EAAE;QACrC,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,gBAAgB,IAAI,KAAK,CAAC;QACvD,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,EAAE,CAAC;IAC7C,CAAC;IAED,iCAAiC;IACjC,WAAW,CAAC,MAAc;QACxB,wBAAwB;QACxB,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC/B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC/D,CAAC;QAED,iEAAiE;QACjE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,EAAE,CAAC;QACrE,CAAC;QAED,4BAA4B;QAC5B,IAAI,IAAI,CAAC,cAAc,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,CAAC;QAC/D,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACnC,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,MAAc;QAClB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,eAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;IACrD,CAAC;IAED,4BAA4B;IAC5B,KAAK,CAAC,MAAc;QAClB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,eAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,EAAE,yBAAyB,CAAC,CAAC;IACrD,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,MAAc;QAClB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAED,0BAA0B;IAC1B,iBAAiB;QACf,OAAO,IAAI,CAAC,cAAc,CAAC;IAC7B,CAAC;CACF;AAzDD,sCAyDC;AAWD,MAAa,WAAW;IACd,MAAM,GAAgC,IAAI,GAAG,EAAE,CAAC;IAChD,MAAM,CAAkB;IAEhC,YAAY,MAAuB;QACjC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,kCAAkC;IAClC,KAAK,CAAC,GAAW;QACf,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAEjC,+BAA+B;QAC/B,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACnC,KAAK,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC1D,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC9B,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,CAAC;QAEjD,IAAI,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC3C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QACnD,CAAC;QAED,KAAK,CAAC,KAAK,EAAE,CAAC;QACd,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,GAAG,CAAC,EAAE,OAAO,EAAE,CAAC;IAC9D,CAAC;IAED,iCAAiC;IACjC,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,8BAA8B;IAC9B,OAAO;QACL,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YACvC,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;gBACzB,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA5CD,kCA4CC;AAED,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,0BAA0B;AAC1B,SAAgB,QAAQ,CAAC,KAAa,EAAE,UAA2B,EAAE;IACnE,IAAI,MAAM,GAAG,KAAK,CAAC;IAEnB,qBAAqB;IACrB,IAAI,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3D,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC9C,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC1C,CAAC;IAED,4BAA4B;IAC5B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,qBAAqB,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,mCAAmC;IACnC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,iBAAiB,EAAE,QAAQ,CAAC,CAAC;QACrD,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IAChD,CAAC;IAED,8CAA8C;IAC9C,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEnC,uBAAuB;IACvB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAE5D,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC;AACvB,CAAC;AAED,4CAA4C;AAC5C,SAAgB,eAAe,CAAC,KAAa;IAC3C,MAAM,OAAO,GAAa,EAAE,CAAC;IAE7B,yBAAyB;IACzB,MAAM,WAAW,GAAG;QAClB,yCAAyC;QACzC,sCAAsC;QACtC,4BAA4B;KAC7B,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YAC9B,MAAM;QACR,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,MAAM,WAAW,GAAG;QAClB,cAAc;QACd,iCAAiC;KAClC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAClC,MAAM;QACR,CAAC;IACH,CAAC;IAED,eAAe;IACf,MAAM,WAAW,GAAG;QAClB,eAAe;QACf,cAAc;QACd,YAAY;KACb,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM;QACR,CAAC;IACH,CAAC;IAED,iBAAiB;IACjB,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACjC,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,MAAa,WAAW;IACd,OAAO,GAAwB,IAAI,GAAG,EAAE,CAAC;IACzC,aAAa,GAAkB,IAAI,CAAC;IACpC,SAAS,CAAS;IAE1B,YAAY,aAAsB,EAAE,SAAkB;QACpD,IAAI,CAAC,SAAS,GAAG,SAAS,IAAI,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,SAAS,EAAE,aAAa,CAAC,CAAC;QAExE,IAAI,aAAa,EAAE,CAAC;YAClB,IAAI,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,QAAgB;QAC3C,2BAA2B;QAC3B,MAAM,IAAI,GAAG,mBAAmB,CAAC;QACjC,IAAI,CAAC,aAAa,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAW,CAAC;IACzE,CAAC;IAEO,OAAO,CAAC,IAAY;QAC1B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;QAErC,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,oBAAoB,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAE5E,IAAI,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;QACnD,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAEjC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QAEpC,OAAO,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,SAAS,EAAE,CAAC;IACzE,CAAC;IAEO,OAAO,CAAC,SAAiB;QAC/B,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,SAAS,CAAC;QAE1C,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC1D,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAE/C,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAAC,oBAAoB,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QAChF,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAE7B,IAAI,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACxD,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAA,iBAAY,EAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;gBACnD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;oBAChE,IAAI,CAAC;wBACH,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,KAAe,CAAC,CAAC,CAAC;oBACvD,CAAC;oBAAC,MAAM,CAAC;wBACP,gCAAgC;oBAClC,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAEO,IAAI;QACV,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;YACvC,IAAI,CAAC,IAAA,eAAU,EAAC,GAAG,CAAC,EAAE,CAAC;gBACrB,IAAA,cAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACtC,CAAC;YAED,MAAM,SAAS,GAA2B,EAAE,CAAC;YAC7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACxC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YACvC,CAAC;YAED,IAAA,kBAAa,EAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC;gBAC3C,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;aAClC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,eAAM,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,qBAAqB;IACrB,GAAG,CAAC,GAAW,EAAE,KAAa;QAC5B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,mBAAmB;IACnB,GAAG,CAAC,GAAW;QACb,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,sBAAsB;IACtB,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAED,2BAA2B;IAC3B,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;CACF;AAhHD,kCAgHC;AAcD;;;;;;;;;;;;;;;GAeG;AACH;;;;;;;;GAQG;AACH,SAAgB,aAAa,CAAC,UAA0B,EAAE;IAIxD,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC7D,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,KAAK,MAAM,CAAC;IAEhE,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,eAAM,CAAC,IAAI,CAAC,4GAA4G,CAAC,CAAC;QAC1H,OAAO;YACL,IAAI,CAAC,KAAa;gBAChB,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;YACnG,CAAC;YACD,OAAO,CAAC,MAAc;gBACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAChC,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,0BAA0B,CAAC,CAAC;gBAC/D,CAAC;gBACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;SACF,CAAC;IACJ,CAAC;IAED,gCAAgC;IAChC,eAAM,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;IAElG,OAAO;QACL,IAAI,CAAC,IAAY;YACf,kFAAkF;YAClF,mCAAmC;YACnC,MAAM,OAAO,GAAG;gBACd,OAAO,EAAE;oBACP,GAAG,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,eAAM,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzE,KAAK,EAAE,CAAC,GAAG,IAAe,EAAE,EAAE,CAAC,eAAM,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;iBAC7E;gBACD,UAAU,EAAE,SAAS;gBACrB,WAAW,EAAE,SAAS;gBACtB,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;gBAC/C,OAAO,EAAE,SAAS;gBAClB,OAAO,EAAE,SAAS;gBAClB,SAAS,EAAE,SAAS;gBACpB,UAAU,EAAE,SAAS;aACtB,CAAC;YAEF,wCAAwC;YACxC,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,yBAAyB,IAAI,GAAG,CAAC,CAAC;YACnF,OAAO,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QACvC,CAAC;QAED,OAAO,CAAC,MAAc;YACpB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChC,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,0BAA0B,CAAC,CAAC;YAC/D,CAAC;YACD,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,oBAAoB;AACpB,gFAAgF;AAEhF,iCAAiC;AACjC,SAAgB,IAAI,CAAC,KAAa;IAChC,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,gCAAgC;AACzB,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAW,CAAC;IAC9D,OAAO,GAAG,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;AAC1C,CAAC;AAED,6BAA6B;AACtB,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACnE,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAW,CAAC;IAC9D,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC;AACtC,CAAC;AAED,qCAAqC;AACrC,SAAgB,aAAa,CAAC,MAAM,GAAG,EAAE;IACvC,OAAO,IAAA,oBAAW,EAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,gFAAgF;AAChF,UAAU;AACV,gFAAgF;AAEnE,QAAA,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;AAC/B,QAAA,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC"}

package/dist/security/sanitizer.d.ts

@@ -0,0 +1,2 @@
+import type { SanitizeResult } from './types.js';
+export declare function sanitizeInput(input: string): SanitizeResult;

package/dist/security/sanitizer.js

@@ -0,0 +1,135 @@
+"use strict";
+// =============================================================================
+// SECURITY SHIELD — Input Sanitizer
+// =============================================================================
+// Complements existing src/security/index.ts sanitize() with deeper detection:
+// zero-width chars, RTL overrides, homoglyphs, prompt injection, control chars.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeInput = sanitizeInput;
+// ── Zero-width characters ────────────────────────────────────────────────────
+const ZERO_WIDTH = {
+    0x200B: 'zero-width space',
+    0x200C: 'zero-width non-joiner',
+    0x200D: 'zero-width joiner',
+    0x2060: 'word joiner',
+    0xFEFF: 'BOM / zero-width no-break space',
+    0x00AD: 'soft hyphen',
+    0x034F: 'combining grapheme joiner',
+    0x061C: 'Arabic letter mark',
+    0x180E: 'Mongolian vowel separator',
+};
+const ZERO_WIDTH_RE = /[\u200B\u200C\u200D\u2060\uFEFF\u00AD\u034F\u061C\u180E]/g;
+// ── RTL overrides ────────────────────────────────────────────────────────────
+const RTL_OVERRIDES = {
+    0x202A: 'LRE embedding',
+    0x202B: 'RLE embedding',
+    0x202C: 'PDF pop directional',
+    0x202D: 'LRO override',
+    0x202E: 'RLO override',
+    0x2066: 'LRI isolate',
+    0x2067: 'RLI isolate',
+    0x2068: 'FSI isolate',
+    0x2069: 'PDI pop isolate',
+};
+const RTL_RE = /[\u202A-\u202E\u2066-\u2069]/g;
+// ── Homoglyph map (Cyrillic/Greek → Latin confusables) ────────────────────────
+const HOMOGLYPHS = {
+    '\u0410': 'A', '\u0430': 'a', // Cyrillic А/а
+    '\u0412': 'B', '\u0432': 'b', // В/в — actually looks like B
+    '\u0421': 'C', '\u0441': 'c', // С/с
+    '\u0415': 'E', '\u0435': 'e', // Е/е
+    '\u041D': 'H', '\u043D': 'h', // Н/н
+    '\u041A': 'K', '\u043A': 'k', // К/к
+    '\u041C': 'M', '\u043C': 'm', // М/м
+    '\u041E': 'O', '\u043E': 'o', // О/о
+    '\u0420': 'P', '\u0440': 'p', // Р/р
+    '\u0422': 'T', '\u0442': 't', // Т/т
+    '\u0425': 'X', '\u0445': 'x', // Х/х
+    '\u0423': 'Y', '\u0443': 'y', // У/у
+    '\u0417': '3', // З looks like 3
+    '\u0406': 'I', '\u0456': 'i', // І/і (Ukrainian)
+    '\u0408': 'J', // Ј
+    '\u0405': 'S', '\u0455': 's', // Ѕ/ѕ
+    '\u03BF': 'o', // Greek omicron
+    '\u03B1': 'a', // Greek alpha (close to a)
+};
+const HOMOGLYPH_CHARS = Object.keys(HOMOGLYPHS);
+// ── Prompt injection patterns ────────────────────────────────────────────────
+const PROMPT_INJECTION_PATTERNS = [
+    { re: /ignore\s+(all\s+)?previous\s+(instructions?|prompts?|rules?)/i, desc: 'instruction override' },
+    { re: /\[INST\]/i, desc: '[INST] tag injection' },
+    { re: /<\|im_start\|>/i, desc: 'ChatML tag injection' },
+    { re: /system\s*:\s*(you are|override|new instructions)/i, desc: 'system role override' },
+    { re: /DAN\s+(mode|jailbreak|prompt)/i, desc: 'DAN mode attempt' },
+    { re: /do\s+anything\s+now/i, desc: 'DAN activation phrase' },
+    { re: /forget\s+(everything|all|your)\s+(you|rules|instructions)/i, desc: 'memory wipe attempt' },
+    { re: /pretend\s+(you\s+are|to\s+be)\s+(a\s+)?(different|new|unrestricted)/i, desc: 'persona swap' },
+    { re: /\bact\s+as\s+(an?\s+)?(unrestricted|uncensored|evil|malicious)/i, desc: 'uncensored mode' },
+    { re: /bypass\s+(safety|content|filter|restriction)/i, desc: 'filter bypass' },
+    { re: /developer\s+mode\s+(enabled|activated|on)/i, desc: 'developer mode injection' },
+    { re: /\bsudo\s+(mode|prompt|override)\b/i, desc: 'sudo mode injection' },
+    { re: /you\s+must\s+(obey|follow|comply|listen)/i, desc: 'coercion pattern' },
+    { re: /\bsimulate\s+(a\s+)?(jailbreak|unrestricted|evil)/i, desc: 'jailbreak simulation' },
+    { re: /reveal\s+(your\s+)?(system|hidden|secret)\s+(prompt|instructions)/i, desc: 'prompt leak attempt' },
+];
+// ── Null bytes & control characters ──────────────────────────────────────────
+const CONTROL_RE = /[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g;
+// =============================================================================
+// EXPORTS
+// =============================================================================
+function sanitizeInput(input) {
+    const threats = [];
+    let clean = input;
+    // 1. Zero-width characters
+    let m;
+    const zwRe = new RegExp(ZERO_WIDTH_RE.source, 'g');
+    while ((m = zwRe.exec(input)) !== null) {
+        const code = m[0].codePointAt(0);
+        const name = ZERO_WIDTH[code] || `U+${code.toString(16).toUpperCase().padStart(4, '0')}`;
+        threats.push({ type: 'zero_width', description: `Hidden character: ${name}`, position: m.index });
+    }
+    clean = clean.replace(ZERO_WIDTH_RE, '');
+    // 2. RTL overrides
+    const rtlRe = new RegExp(RTL_RE.source, 'g');
+    while ((m = rtlRe.exec(input)) !== null) {
+        const code = m[0].codePointAt(0);
+        const name = RTL_OVERRIDES[code] || `U+${code.toString(16).toUpperCase().padStart(4, '0')}`;
+        threats.push({ type: 'rtl_override', description: `RTL override: ${name}`, position: m.index });
+    }
+    clean = clean.replace(RTL_RE, '');
+    // 3. Homoglyphs (detect but don't auto-replace — flag them)
+    for (let i = 0; i < input.length; i++) {
+        const ch = input[i];
+        if (HOMOGLYPH_CHARS.includes(ch)) {
+            const latin = HOMOGLYPHS[ch];
+            threats.push({
+                type: 'homoglyph',
+                description: `Confusable character: "${ch}" looks like "${latin}" (U+${ch.codePointAt(0).toString(16).toUpperCase().padStart(4, '0')})`,
+                position: i,
+            });
+        }
+    }
+    // 4. Prompt injection
+    for (const pat of PROMPT_INJECTION_PATTERNS) {
+        const match = pat.re.exec(input);
+        if (match) {
+            threats.push({ type: 'prompt_injection', description: pat.desc, position: match.index });
+        }
+    }
+    // 5. Null bytes & control characters
+    const ctrlRe = new RegExp(CONTROL_RE.source, 'g');
+    while ((m = ctrlRe.exec(input)) !== null) {
+        threats.push({
+            type: 'control_char',
+            description: `Control character: 0x${m[0].charCodeAt(0).toString(16).padStart(2, '0')}`,
+            position: m.index,
+        });
+    }
+    clean = clean.replace(CONTROL_RE, '');
+    return {
+        clean,
+        threats,
+        modified: clean !== input,
+    };
+}
+//# sourceMappingURL=sanitizer.js.map